@otislinker345 I believe the 'verify' is to make sure it is a valid JWT indicates the signature is valid and the payload has not be tampered with. You will need to look at the roles in a valid JWT to determine if a user has that role.
Having contemplated raising a bug for this issue, I've discovered that it, or something very similar, is in fact already the subject of a GitHub Issue. The issue was raised out of this Forum Thread, which provides some avenues for further investigation. Thanks for the responses @mark-robustelli & @kvi68507